Overview

overview

10

Static

static

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1365e7708c818aa8a3cbed2a295ce2d585c654d80b78b1e5b3af9f30c654a4fa

  • Size

    2.4MB

  • Sample

    221101-kdqfsaaefn

  • MD5

    7f0b957f1ace065fb1fe2419efc7b217

  • SHA1

    f755d302d8e14e072ef6dc5a6d3f4d300eefe76e

  • SHA256

    1365e7708c818aa8a3cbed2a295ce2d585c654d80b78b1e5b3af9f30c654a4fa

  • SHA512

    b91fa0ef1dea5b367c499ed17837ab8f9adfa5b4402bff5d9bfc569d3ae2ce2a85dc59c04accb15a1fe57a3f308f40dad97f089f329faa97beae829ad5e64ffa

  • SSDEEP

    24576:4BIOHYWYBzmqY1M99o6erpCR16n0o+93FpeUk20AbJjLyuNEYBLul3RuQ55313U:4BIW3X0o+JFpef20AbJjAl3O

Score
10/10
redlineruzkiinfostealer

Malware Config

Extracted

Family

redline

Botnet

ruzki

C2

185.241.54.113:31049

Attributes
  • auth_value

    beff5419044317cfc16dabbe118f4644

Targets

    • Target

      1365e7708c818aa8a3cbed2a295ce2d585c654d80b78b1e5b3af9f30c654a4fa

    • Size

      2.4MB

    • MD5

      7f0b957f1ace065fb1fe2419efc7b217

    • SHA1

      f755d302d8e14e072ef6dc5a6d3f4d300eefe76e

    • SHA256

      1365e7708c818aa8a3cbed2a295ce2d585c654d80b78b1e5b3af9f30c654a4fa

    • SHA512

      b91fa0ef1dea5b367c499ed17837ab8f9adfa5b4402bff5d9bfc569d3ae2ce2a85dc59c04accb15a1fe57a3f308f40dad97f089f329faa97beae829ad5e64ffa

    • SSDEEP

      24576:4BIOHYWYBzmqY1M99o6erpCR16n0o+93FpeUk20AbJjLyuNEYBLul3RuQ55313U:4BIW3X0o+JFpef20AbJjAl3O

    Score
    10/10
    redlineruzkiinfostealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks